protected override bool AuthorizeCore(HttpContextBase httpContext) { var request = httpContext.Request.RequestContext; //get controller name controllerName = request.RouteData.Values["controller"].ToString(); //get action name actionName = request.RouteData.Values["action"].ToString(); //get UriAction var uriAction = AppReflection.GetUriAction(controllerName, actionName); var isAuth = base.AuthorizeCore(httpContext); //not authorize if (!isAuth) { return(false); } if (AppReflection.HasAuthorizeInfo(string.Format("{0}Controller", controllerName), actionName)) { var principal = (ClaimsPrincipal)Thread.CurrentPrincipal; var userRoles = principal.Claims.Where(c => c.Type == ClaimTypes.Role).Select(c => c.Value); //get permitted role-Id var permittedRoles = AppContext.UnitOfWork.AppRoleAction.Get(r => r.Action.UriAction == uriAction); //check if action is already stored if (permittedRoles.Count() == 0) { throw new HttpException(608, string.Format("Action {0} was not registered. Please contact administrator", uriAction.ToUpper())); } //check if the given role has access to this action var roleIdList = permittedRoles.Select(id => id.RoleId).ToArray(); var testRoles = AppContext.UnitOfWork.AppRole.Get(r => userRoles.Contains(r.Name) && roleIdList.Contains(r.Id)); if (testRoles.Count() == 0) { accepted = false; return(false); } } return(true); }
public override void OnException(ExceptionContext filterContext) { base.OnException(filterContext); //skip custom error handler if the exception has been handled if (filterContext.ExceptionHandled) { return; } //get controller var controller = filterContext.RouteData.Values["controller"].ToString(); //get action var action = filterContext.RouteData.Values["action"].ToString(); //get UriAction var uriAction = AppReflection.GetUriAction(controller, action); //create error instance var errModel = new AppError(); //set other attributes errModel.Client = filterContext.HttpContext.Request.UserHostAddress; errModel.UserName = filterContext.HttpContext.User.Identity.Name; errModel.Timestamp = DateTime.Now; errModel.ControllerName = controller; errModel.ActionName = action; //get user error message //var errMsg = filterContext.Exception.Message.Split(("$$$").ToCharArray()); if (filterContext.Exception.GetType().Equals(typeof(HttpException))) { //set error title errModel.Code = ((HttpException)filterContext.Exception).GetHttpCode(); errModel.Title = string.Format("Error: {0} {1}", (((HttpStatusCode)Enum.ToObject(typeof(HttpStatusCode), errModel.Code))).ToString(), errModel.Code.ToString()); if (errModel.Code == 401) { //get the required permission code to access this resource var permission = AppContext.UnitOfWork.AppAction.Get(a => a.UriAction == uriAction); if (permission.Count() > 0) { //handle unauthorized Exception errModel.Message = string.Format("Permission code {0} is required for this action", permission.First().Id); errModel.StackTrace = permission.First().Description; } } else if (errModel.Code == 608) { errModel.Title = string.Format("Error: User Defined Validation {0}", errModel.Code); errModel.Message = filterContext.Exception.Message; errModel.StackTrace = string.Empty; } else { errModel.Message = filterContext.Exception.Message; errModel.StackTrace = filterContext.Exception.StackTrace.ToString(); } } else { errModel.Code = filterContext.Exception.HResult; errModel.Title = errModel.Title = string.Format("Error: {0}", filterContext.Exception.HResult.ToString()); errModel.Message = filterContext.Exception.Message; //get InnerException Error Message if (filterContext.Exception.InnerException != null) { errModel.Message = string.Format("{0} $$$ {1}", errModel.Message, filterContext.Exception.InnerException.Message); } errModel.StackTrace = filterContext.Exception.StackTrace.ToString(); errModel.ParamInfo = filterContext.HttpContext.Request.QueryString.ToString(); } //log error into database try { //UnitOfWork.AppsError.Insert(errModel); //UnitOfWork.Save(); var dbContext = new AppDbContext(); dbContext.AppErrors.Add(errModel); dbContext.SaveChanges(); } catch (DbEntityValidationException ex) { var errmsg = ex.EntityValidationErrors.SelectMany(x => x.ValidationErrors).Select(x => x.ErrorMessage); errModel.Message = string.Format("{0} -%- {1}", errModel.Message, string.Concat(errmsg)); } filterContext.Controller.ViewData["ErrorModel"] = errModel; //confirm that error is handled filterContext.ExceptionHandled = true; filterContext.HttpContext.Response.Clear(); }